@fabricorg/platform-host 8.8.0 → 8.10.0

package/dist/index.d.cts

@@ -1,5 +1,79 @@
 import { ActionDefinition, ActionId, ActionStatus, ActorType, AdapterCircuitBreakerProvider, AdapterImplementation, AgentActionPolicyContext, AgentActionPolicyDecision, AgentActionRiskTier, AgentActionRoute, AssetEventEnvelope, EvidencePacketReference, ExecutionAttestation, ExecutionPrincipal, ExternalReconciliation, FabricRuntimeServices, GovernanceRuntimeEvidence, ModuleRegistry, MutationFootprint, MutationGovernanceResolver, PolicyObligation, PolicyObligationStatus, PolicyOutcome, RuntimePolicyDefinition, StagedInvocationRequest, canonicalJson } from "@fabricorg/platform";
 import { AssemblyLockfile } from "@fabricorg/assembly";
+//#region src/erasure-types.d.ts
+type StoredRecordErasureTarget = {
+  readonly kind: "invocation";
+  readonly invocationId: string;
+} | {
+  readonly kind: "event";
+  readonly eventId: string;
+};
+interface ErasurePayloadFields {
+  invocation: "parameters" | "result" | "error" | "provenance" | "authorizationBinding" | "authorizationReconciliation" | "adapterReconciliation" | "hitlReason" | "approvalDecision" | "mutationFootprint" | "executionPrincipal" | "runtimeEvidence" | "pendingCompletion" | "externalCompletion" | "pendingStateTransition" | "finalizationCheckpoint" | "approvalExpiry" | "agentProposal" | "submissionRefusal";
+  adapter: "input" | "output" | "error" | "reconciliation";
+  staged: "parameters" | "lastError";
+  policy_evaluation: "outcome";
+  policy_obligation: "description" | "evidenceReferences" | "metadata";
+  execution_attestation: "attestation";
+  external_reconciliation: "reconciliation";
+  event: "payload" | "provenance";
+  outbox: "lastError" | "traceContext" | "payload" | "provenance";
+  outbox_requeue: "reason" | "priorLastError";
+}
+type ErasureRecordKind = keyof ErasurePayloadFields;
+/** Protected nested keys are omitted from the callback; stores restore structure and overwrite payload digests. */
+type StoredRecordErasureView = { [K in ErasureRecordKind]: {
+  readonly kind: K;
+  readonly id: string;
+  readonly tenantId: string;
+  readonly spaceId: string;
+  readonly invocationId?: string;
+  readonly eventId?: string;
+  readonly eventType?: string;
+  fields: Partial<Record<ErasurePayloadFields[K], unknown>>;
+}; }[ErasureRecordKind];
+/** Validated identifying facts sent to the application authorizer; no stored payload or callback. */
+interface StoredRecordErasureAuthorizationInput {
+  /** Trusted operator identity supplied by the authenticated application session. */
+  readonly actorId: string;
+  readonly actorType: ActorType;
+  readonly tenantId: string;
+  readonly spaceId: string;
+  readonly requestId: string;
+  readonly targets: readonly StoredRecordErasureTarget[];
+}
+interface EraseStoredRecordsInput extends StoredRecordErasureAuthorizationInput {
+  /** Target-lock acquisition budget in milliseconds, 1–60000; default 250. */
+  readonly lockTimeoutMs?: number;
+  /** Rewrite work budget in milliseconds, 1–60000; default 5000. */
+  readonly workTimeoutMs?: number;
+  /** Synchronous JSON-data transformation. A thrown error or invalid result rolls back the batch. */
+  readonly redact: (record: StoredRecordErasureView) => StoredRecordErasureView;
+}
+type StoredRecordErasureOutcome = "erased" | "already_erased" | "active" | "not_found";
+interface EraseStoredRecordsResult {
+  targets: Array<StoredRecordErasureTarget & {
+    outcome: StoredRecordErasureOutcome;
+  }>;
+  /** Records processed, including records processed again by repeat erasure. */
+  counts: Partial<Record<ErasureRecordKind, number>>;
+}
+interface ErasablePlatformHostStore<TDb> extends PlatformHostStore<TDb> {
+  /**
+   * Unauthenticated storage port, not an authorization boundary; callers must enforce authorization.
+   * Atomic rewrite/marker/audit operation. The audit retains actorId/actorType as identifying metadata.
+   * Invocation reads expose storedRecordsErased after commit.
+   */
+  eraseStoredRecords(input: EraseStoredRecordsInput): Promise<EraseStoredRecordsResult>;
+}
+interface StoredRecordErasureHost {
+  /** Throws StoredRecordErasureAuthorizationError (not_authorized) before store access on authorization refusal. */
+  eraseStoredRecords(input: EraseStoredRecordsInput): Promise<EraseStoredRecordsResult>;
+}
+export declare const HOST_RECORDS_ERASED_EVENT: "HostRecordsErased";
+/** Sentinel replacing required payload digests after stored-record erasure. */
+export declare const ERASED_DIGEST: "erased";
+//#endregion
 //#region src/observability.d.ts
 /** Version of the vendor-neutral health/readiness contract. */
 export declare const PLATFORM_HOST_HEALTH_CONTRACT_VERSION: 1;
@@ -203,30 +277,60 @@ export declare class IdempotencyConflictError extends Error {
 export type ActionAdmissionRefusal = "refused" | "failed" | "timed_out" | "invalid_decision" | "invalid_parameters";
 /**
  * Thrown by `submitAction` when a declared admission check did not admit the
- * submission. Host wrote nothing for it: no invocation, idempotency key,
- * event, policy record or error. The message holds the action id, the
- * refusal and, for `refused`, the check's code; never a submitted value or
- * anything the check threw.
+ * submission. By default Host writes nothing for it. With recordRefusals
+ * enabled and an idempotency key, a definitive refusal can be recorded;
+ * `recorded` confirms persistence of the terminal refusal. The message holds
+ * the action id, the refusal and, for `refused`, the check's fixed code. It omits parameter
+ * payloads and caught callback error text.
  */
 export declare class ActionAdmissionError extends Error {
   readonly actionId: string;
   readonly refusal: ActionAdmissionRefusal;
   /** The check's own code, present only for `refused`. */
   readonly refusalCode?: string | undefined;
+  readonly recorded: boolean;
   readonly code: "ACTION_ADMISSION_REFUSED";
   constructor(actionId: string, refusal: ActionAdmissionRefusal,
   /** The check's own code, present only for `refused`. */
-  refusalCode?: string | undefined);
+  refusalCode?: string | undefined, recorded?: boolean);
 }
 export type SubmissionRefusal = "entitlement" | "authorization";
 /** A definitive authorization-boundary refusal before an invocation is created. */
 export declare class SubmissionRefusalError extends Error {
   readonly actionId: string;
   readonly refusal: SubmissionRefusal;
+  readonly recorded: boolean;
   readonly code: "ACTION_SUBMISSION_REFUSED";
-  constructor(actionId: string, refusal: SubmissionRefusal, message: string);
+  constructor(actionId: string, refusal: SubmissionRefusal, message: string, recorded?: boolean);
+}
+/** Fixed refusal evidence; no submitted values belong in a descriptor. */
+export type SubmissionRefusalDescriptor = {
+  class: "entitlement" | "authorization";
+} | {
+  class: "admission";
+  refusal: "refused" | "invalid_parameters";
+  refusalCode?: string;
+};
+/** Minimal identity and evidence for an insert-only, terminal refusal. */
+export interface RecordSubmissionRefusalInput {
+  id: string;
+  tenantId: string;
+  spaceId: string;
+  actionId: ActionId;
+  actionVersion: number;
+  actorId: string;
+  actorType: ActorType;
+  authorizationBindingId?: string;
+  idempotencyKey: string;
+  submissionRefusal: SubmissionRefusalDescriptor;
+  parameterDigest?: string;
+  parameterDigestAlgorithm?: "fabric-canonical-json-sha256-v1";
+  correlationId: string;
+  causationId?: string;
+  createdAt: Date;
+  updatedAt: Date;
 }
-export type ExternalCompletionRefusal = "still_executing" | "not_found" | "not_awaiting" | "immediate_contract" | "reference_mismatch" | "provider_mismatch" | "invalid_completion" | "result_invalid" | "redaction_failed";
+export type ExternalCompletionRefusal = "erased" | "still_executing" | "not_found" | "not_awaiting" | "immediate_contract" | "reference_mismatch" | "provider_mismatch" | "invalid_completion" | "result_invalid" | "redaction_failed";
 /**
  * Why a completion was not applied, typed so a webhook handler can answer
  * the external system correctly: `retryable` means the invocation is still
@@ -292,6 +396,9 @@ export interface HostHitlEvaluatorContext extends AgentActionPolicyContext {
   invocation: Readonly<ActionInvocationRecord>;
 }
 export interface ActionInvocationRecord {
+  /** Store-owned erasure marker; callers cannot patch it through Host write types. */
+  readonly storedRecordsErased?: true;
+  submissionRefusal?: SubmissionRefusalDescriptor;
   readonly agentProposal?: AgentProposal;
   id: string;
   tenantId: string;
@@ -342,7 +449,7 @@ export interface ActionInvocationRecord {
   externalCompletion?: RecordedExternalCompletion;
   /** Opaque, non-secret reference used to revalidate delegated execution authority. */
   authorizationBindingId?: string;
-  /** Worker claims including the first; approval acceptance sets a minimum of 1. */
+  /** Worker claims including the first; inline approval acceptance sets a minimum of 1. Recording preserves the count. */
   attemptCount: number;
   /** Latest claim durably deferred in pre-effect governance; permits only the immediately next claim. */
   deferredBeforeEffectAttempt?: number;
@@ -405,6 +512,7 @@ export declare const MAX_APPROVAL_EVIDENCE_BYTES: number;
 export declare const APPROVAL_REQUESTED_EVENT: "ApprovalRequested";
 export declare const APPROVAL_DECIDED_EVENT: "ApprovalDecided";
 export declare const APPROVAL_EXPIRED_EVENT: "ApprovalExpired";
+export declare const APPROVAL_DECISION_REFUSED_EVENT: "ApprovalDecisionRefused";
 export interface ApprovalRequestedPayload {
   route: AgentActionRoute;
   riskTier: AgentActionRiskTier;
@@ -435,6 +543,10 @@ export interface ActionApprovalDecision {
 }
 export interface PersistedActionApprovalDecision extends Omit<ActionApprovalDecision, "decidedAt"> {
   decidedAt: Date;
+  /** Caller-stable identity for the separate recording API; absent on inline and older decisions. */
+  requestId?: string;
+  /** Claim count when recorded; the next claim is the approved first execution. */
+  recordedAtAttempt?: number;
 }
 export interface PolicyEvaluationRecord {
   id: string;
@@ -554,7 +666,7 @@ export interface AdapterInvocationRecord {
   createdAt: Date;
   updatedAt: Date;
 }
-export interface CreateActionInvocationInput extends Omit<ActionInvocationRecord, "createdAt" | "updatedAt" | "attemptCount" | "leaseOwner" | "leaseExpiresAt" | "leaseToken" | "stagedOrigin"> {}
+export interface CreateActionInvocationInput extends Omit<ActionInvocationRecord, "createdAt" | "updatedAt" | "attemptCount" | "leaseOwner" | "leaseExpiresAt" | "leaseToken" | "stagedOrigin" | "storedRecordsErased"> {}
 /** Scope of an adapter checkpoint within its owning action invocation. */
 export interface AdapterInvocationScope {
   tenantId: string;
@@ -603,6 +715,7 @@ export interface AdapterInvocationWriteInput {
   };
 }
 export interface PlatformHostStore<TDb> {
+  getSubmissionOutcomeByKey?(key: Readonly<SubmissionOutcomeKey>): Promise<StoredSubmissionOutcomeRecord | undefined>;
   readonly db: TDb;
   /**
    * Run against the store's domain handle. This base seam does not promise a
@@ -610,7 +723,17 @@ export interface PlatformHostStore<TDb> {
    * canonical events, and invocation state must commit atomically.
    */
   transaction<TResult>(run: (db: TDb) => Promise<TResult>): Promise<TResult>;
+  /**
+   * First row wins for a supplied idempotency key within tenant, space and action id,
+   * including the empty-string key. Replays return the existing row unchanged;
+   * the store does not classify submission conflicts (Host does). Unkeyed creates
+   * with distinct ids insert independently. `invocationIdempotencyChecks` also
+   * covers concurrent key arbitration and preservation of `admittedAt` through
+   * an update of another field, plus refusal/admitted arbitration when supported.
+   */
   createActionInvocation(input: CreateActionInvocationInput): Promise<ActionInvocationRecord>;
+  /** Insert a refusal or return the key's existing winner unchanged. */
+  recordSubmissionRefusal?(input: RecordSubmissionRefusalInput): Promise<ActionInvocationRecord>;
   getActionInvocation(id: string, tenantId: string, spaceId: string): Promise<ActionInvocationRecord | undefined>;
   /** Resolve Host-owned staged identity within one tenant and space. */
   getActionInvocationByStagedOrigin?(tenantId: string, spaceId: string, origin: StagedInvocationOrigin): Promise<ActionInvocationRecord | undefined>;
@@ -684,8 +807,10 @@ export interface PlatformHostStore<TDb> {
  * back when `run` throws.
  */
 export interface PlatformHostMutationTransaction<TDb> {
+  /** Lock due approval candidates in this transaction, skipping locked invocation rows. */
+  lockDueApprovals?(input: ExpireDueApprovalsStoreInput): Promise<ActionInvocationRecord[]>;
   /** Conditional SQL approval write on the transaction connection; lifecycle events are appended by the caller in this unit of work. */
-  beginApprovalDecision?(input: Omit<BeginApprovalDecisionInput, "lifecycleEvent">): Promise<ApprovalDecisionTransitionResult>;
+  beginApprovalDecision?(input: Omit<BeginApprovalDecisionInput<TDb>, "lifecycleEvent">): Promise<ApprovalDecisionTransitionResult>;
   readonly db: TDb;
   /**
    * Read and lock an invocation until this transaction completes.
@@ -694,9 +819,12 @@ export interface PlatformHostMutationTransaction<TDb> {
   getActionInvocationForUpdate?(id: string, tenantId: string, spaceId: string): Promise<ActionInvocationRecord | undefined>;
   /**
    * Read one event by its stable identity inside the transaction.
+   * Erasure-capable stores expose storedRecordsErased on rewritten events.
    * Required by serialized saga parent lifecycle transitions.
    */
-  getEvent?(id: string, tenantId: string, spaceId: string): Promise<AssetEventEnvelope | undefined>;
+  getEvent?(id: string, tenantId: string, spaceId: string): Promise<(AssetEventEnvelope & {
+    readonly storedRecordsErased?: true;
+  }) | undefined>;
   /**
    * First-write-wins: an event ID the store already holds, in any tenant or space, is a no-op
    * that keeps the first event. Do not throw, replace or merge it, regardless of
@@ -747,7 +875,7 @@ export interface PlatformHostMutationTransaction<TDb> {
    * governance evidence cannot share the event/verdict transaction.
    */
   appendExternalReconciliation?: GovernancePlatformHostStore<TDb>["appendExternalReconciliation"];
-  /** Atomically retain an immutable staged batch with the parent mutation. */
+  /** Atomically retain a staged batch with the parent mutation; erasure may later rewrite its payloads. */
   stageInvocations?(records: readonly StagedInvocationRecord[]): Promise<void>;
 }
 export type StagedInvocationStatus = "pending" | "dispatched" | "rejected" | "dead_lettered" | "cancelled";
@@ -970,8 +1098,31 @@ export interface OutboxPlatformHostStore<TDb> extends PlatformHostStore<TDb> {
    * sequences and timestamps and potentially different payloads.
    */
   appendEventWithOutbox(event: AssetEventEnvelope, metadata: OutboxEventMetadata): Promise<void>;
+  /**
+   * `outboxRelayChecks`: claim pending rows available at or before `now` with no
+   * unexpired lease; equality at lease expiry is claimable. Concurrent workers
+   * claim a row once between them. A claim sets owner and expiry to the worker
+   * and `now + leaseDurationMs`, increments attempts by one and increases the
+   * row's token. `limit: 1` returns one row when eligible rows exist.
+   * Published and dead-lettered rows are excluded; returned ordering is unspecified.
+   * `outboxRelayChecks` requires numeric lease tokens that increase on each claim,
+   * including reclaim, despite the optional token fields in the general interfaces.
+   */
   claimOutbox(input: ClaimOutboxInput): Promise<OutboxRecord[]>;
+  /**
+   * `outboxRelayChecks`: reject a stale token after reclaim or a wrong worker
+   * without changing the row. With the current owner/token, set `published`
+   * and `publishedAt` and clear lease owner/expiry. A previously settled row
+   * rejects another settlement under its former owner/token.
+   */
   markOutboxPublished(id: string, workerId: string, publishedAt: Date, leaseToken?: number): Promise<void>;
+  /**
+   * `outboxRelayChecks`: reject a stale token after reclaim or a wrong worker
+   * without changing the row. With the current owner/token, set `pending` and
+   * the supplied `availableAt`, clear lease owner/expiry and retain attempts;
+   * `deadLetter: true` sets `dead_letter`. A previously settled row rejects
+   * another settlement under its former owner/token.
+   */
   markOutboxFailed(input: {
     id: string;
     workerId: string;
@@ -980,6 +1131,13 @@ export interface OutboxPlatformHostStore<TDb> extends PlatformHostStore<TDb> {
     availableAt: Date;
     deadLetter: boolean;
   }): Promise<void>;
+  /**
+   * `outboxRelayChecks`: return false for a wrong worker/token or a lease expired
+   * at or before `now`, leaving expiry unchanged. For the current unexpired
+   * owner/token, return true and set expiry to `now + leaseDurationMs`.
+   * When `renewOutboxLeaseAndRead` is present, the same probes expect undefined
+   * on refusal and the renewed record on success.
+   */
   renewOutboxLease(input: {
     id: string;
     workerId: string;
@@ -987,6 +1145,14 @@ export interface OutboxPlatformHostStore<TDb> extends PlatformHostStore<TDb> {
     leaseDurationMs: number;
     now?: Date;
   }): Promise<boolean>;
+  /** Renew and hydrate the stored envelope atomically for erasure-safe publication. */
+  renewOutboxLeaseAndRead?(input: {
+    id: string;
+    workerId: string;
+    leaseToken: number;
+    leaseDurationMs: number;
+    now?: Date;
+  }): Promise<OutboxRecord | undefined>;
   listOutbox(input?: {
     tenantId?: string;
     spaceId?: string;
@@ -1120,6 +1286,15 @@ export interface OutboxRequeueAuthorizationInput {
  * but cannot claim atomic domain-write/event persistence.
  */
 export interface AtomicMutationPlatformHostStore<TDb> extends PlatformHostStore<TDb> {
+  /**
+   * Optional retry evidence: reject with ConfirmedTransactionRollback(callbackError)
+   * after rollback succeeds. Its cause must be the identical callback error. A provider
+   * that does not supply this evidence retains the existing failure behavior.
+   * A commit error is not evidence that the callback rolled back. Built-in stores
+   * expose evidence for Host's internal handler callback request; ordinary public
+   * callbacks and store-internal transactions retain their original error objects.
+   * Host normalizes confirmation from custom stores at non-handler transaction sites.
+   */
   transactionWithEvents<TResult>(run: (transaction: PlatformHostMutationTransaction<TDb>) => Promise<TResult>): Promise<TResult>;
 }
 export interface ApprovalLifecycleEvent {
@@ -1128,6 +1303,50 @@ export interface ApprovalLifecycleEvent {
 }
 /** Called within the transition transaction. Must be pure and return audit-safe data. Sequence is assigned by the store. */
 export type ApprovalLifecycleEventFactory = (invocation: ActionInvocationRecord, kind: "requested" | "decided" | "expired") => ApprovalLifecycleEvent;
+export interface RecordApprovalDecisionRequest extends ActionApprovalDecision {
+  /** Non-blank caller-stable identifier, at most 256 characters; not trimmed or regenerated by Host. */
+  requestId: string;
+}
+export type RecordApprovalDecisionOutcome = "approved" | "denied" | "unauthorized" | "expired" | "already_decided" | "late_terminal" | "not_waiting" | "unsupported";
+export interface RecordApprovalDecisionResult {
+  outcome: RecordApprovalDecisionOutcome;
+  actionInvocationId: string;
+  status: ActionInvocationRecord["status"];
+  replayed: boolean;
+  /** Included for approved/denied outcomes, including replays; omitted for non-applied outcomes. */
+  decision?: PersistedActionApprovalDecision;
+}
+export interface TransactionalApprovalAuthorization<TDb = unknown> {
+  (db: TDb, invocation: Readonly<ActionInvocationRecord>): Promise<boolean>;
+}
+export interface RecordApprovalDecisionStoreInput<TDb = unknown> {
+  actionInvocationId: string;
+  tenantId: string;
+  spaceId: string;
+  now: Date;
+  /** Carries no `recordedAtAttempt`: the store assigns it from the locked row. */
+  decision: Omit<PersistedActionApprovalDecision, "recordedAtAttempt"> & {
+    requestId: string;
+  };
+  /** Result of the compatibility authorization boundary evaluated before the transaction. */
+  authorized: boolean;
+  /**
+   * Optional authority check on this transaction's `db`, after the invocation row is locked
+   * and classified as writable, immediately before the decision write.
+   */
+  authorizeInTransaction?: TransactionalApprovalAuthorization<TDb>;
+  actionKind: "atomic" | "saga" | "unknown";
+  lifecycleEvent?: ApprovalLifecycleEventFactory;
+  /** Called under the invocation lock after any update, with the pre-patch observed row. */
+  attemptEvent?: (invocation: ActionInvocationRecord, outcome: RecordApprovalDecisionOutcome) => ApprovalLifecycleEvent;
+}
+export interface RecordApprovalDecisionStoreResult {
+  /** Whether this transaction changed the invocation; false for replays and previously expired rows. */
+  applied: boolean;
+  outcome: RecordApprovalDecisionOutcome;
+  invocation: ActionInvocationRecord;
+  replayed: boolean;
+}
 export interface ExpireDueApprovalsInput {
   tenantId?: string;
   spaceId?: string;
@@ -1148,7 +1367,7 @@ export interface ParkApprovalInput {
   leaseToken?: number;
   lifecycleEvent?: ApprovalLifecycleEventFactory;
 }
-export interface BeginApprovalDecisionInput {
+export interface BeginApprovalDecisionInput<TDb = unknown> {
   lifecycleEvent?: ApprovalLifecycleEventFactory;
   actionInvocationId: string;
   tenantId: string;
@@ -1157,15 +1376,26 @@ export interface BeginApprovalDecisionInput {
   leaseOwner: string;
   leaseDurationMs: number;
   now: Date;
+  /**
+   * Optional authority check on this transaction's `db`, after the invocation row is locked
+   * and classified as writable, immediately before the decision write.
+   */
+  authorizeInTransaction?: TransactionalApprovalAuthorization<TDb>;
 }
 export interface ApprovalDecisionTransitionResult {
   applied: boolean;
   invocation?: ActionInvocationRecord;
+  /** True when a configured in-transaction authority check refused the decision. */
+  authorizationDenied?: boolean;
 }
-/** Optional store capability required only when agent HITL or approval resume is used. */
+/** Approval persistence capabilities used by Host HITL, inline resume and decision recording. */
 export interface ApprovalPlatformHostStore<TDb> extends PlatformHostStore<TDb> {
+  /** Serialize classification, optional events/outbox and the queued/terminal transition in one transaction. */
+  recordApprovalDecision?(input: RecordApprovalDecisionStoreInput<TDb>): Promise<RecordApprovalDecisionStoreResult>;
   /** True only when approval transitions and lifecycle outbox events share a transaction. */
   readonly transactionalApprovalLifecycle?: boolean;
+  /** True only when approval authority callbacks run under the locked row in the decision transaction. */
+  readonly transactionalApprovalAuthorization?: boolean;
   /**
    * Conditionally park an executable invocation only with its matching lease owner/generation
    * (when leased) and no prior approval decision. Persist the deadline supplied in input.
@@ -1195,7 +1425,7 @@ export interface ApprovalPlatformHostStore<TDb> extends PlatformHostStore<TDb> {
    * or expired event/outbox writes and state change must commit in the same atomic unit
    * of work, or roll back together. Required when implementing parkApproval/expireDueApprovals.
    */
-  beginApprovalDecision(input: BeginApprovalDecisionInput): Promise<ApprovalDecisionTransitionResult>;
+  beginApprovalDecision(input: BeginApprovalDecisionInput<TDb>): Promise<ApprovalDecisionTransitionResult>;
 }
 /** Optional durable capabilities used when external-governance enrichment is configured. */
 export interface GovernancePlatformHostStore<TDb> extends PlatformHostStore<TDb> {
@@ -1294,6 +1524,10 @@ export interface ActionExecutionAuthorizationInput extends ActionAuthorizationIn
   invocation: Readonly<ActionInvocationRecord>;
   executionReason: ActionExecutionReason;
 }
+/** Execution authorization input evaluated on the handler transaction's domain handle. */
+export interface ActionExecutionAuthorizationInTransactionInput<TDb> extends ActionExecutionAuthorizationInput {
+  db: TDb;
+}
 /** Trusted authorization input for deciding a parked approval. */
 export interface ActionApprovalAuthorizationInput extends ActionAuthorizationInput {
   decision: ActionApprovalDecision;
@@ -1302,6 +1536,10 @@ export interface ActionApprovalAuthorizationInput extends ActionAuthorizationInp
   /** The durable (post-redaction) invocation record as read before the decision transition. */
   invocation: Readonly<ActionInvocationRecord>;
 }
+/** Approval authorization input evaluated while the invocation row is locked for its decision write. */
+export interface ActionApprovalAuthorizationInTransactionInput<TDb> extends ActionApprovalAuthorizationInput {
+  db: TDb;
+}
 /**
  * Input to `resolvePolicies`. Carries the invocation identity and the
  * schema-parsed durable (post-redaction) parameters so a resolver can choose
@@ -1312,7 +1550,7 @@ export interface ActionApprovalAuthorizationInput extends ActionAuthorizationInp
 export interface ResolvePoliciesInput extends ActionExecutionAuthorizationInput {
   declaredPolicyIds: readonly string[];
 }
-export interface PlatformHostAuthorization {
+export interface PlatformHostAuthorization<TDb = unknown> {
   checkEntitlement(input: ActionAuthorizationInput): Promise<boolean>;
   authorize(input: ActionAuthorizationInput): Promise<boolean>;
   /**
@@ -1320,14 +1558,25 @@ export interface PlatformHostAuthorization {
    * execution. When absent, the Host reuses `authorize` at this boundary.
    */
   authorizeExecution?(input: ActionExecutionAuthorizationInput): Promise<boolean>;
+  /** Optional final execution authority check on the handler transaction, immediately before the effect. */
+  authorizeExecutionInTransaction?(input: ActionExecutionAuthorizationInTransactionInput<TDb>): Promise<boolean>;
   /** Optional distinct authorization boundary for human/system approval decisions. */
   authorizeApproval?(input: ActionApprovalAuthorizationInput): Promise<boolean>;
+  /** Optional final approval authority check under the locked row in the decision transaction. */
+  authorizeApprovalInTransaction?(input: ActionApprovalAuthorizationInTransactionInput<TDb>): Promise<boolean>;
   /**
    * Authorization for `requeueOutboxDeadLetter`. There is no action to fall
    * back to, so when this is absent every requeue is refused as
    * `not_authorized`. A throw propagates and nothing is requeued.
    */
   authorizeOutboxRequeue?(input: OutboxRequeueAuthorizationInput): Promise<boolean>;
+  /**
+   * Erasure operator authorization after validation and before store access. No fallback:
+   * absence or a result other than true raises StoredRecordErasureAuthorizationError.
+   * A thrown hook error propagates unchanged; neither outcome reaches the store.
+   * Receives identifying facts and detached validated targets, without redact or stored payloads.
+   */
+  authorizeStoredRecordErasure?(input: StoredRecordErasureAuthorizationInput): Promise<boolean>;
 }
 export interface DispatchActionInput {
   actionInvocationId: string;
@@ -1497,7 +1746,7 @@ export interface ErrorTextRedactionContext {
 }
 export interface PlatformHostOptions<TDb> {
   store: PlatformHostStore<TDb>;
-  authorization: PlatformHostAuthorization;
+  authorization: PlatformHostAuthorization<TDb>;
   /** Preferred explicit catalog assembled from this runtime's Fabric modules. */
   registry?: Pick<ModuleRegistry<TDb>, "resolveAction" | "resolvePolicy" | "resolveStateMachine"> & Partial<Pick<ModuleRegistry<TDb>, "orderedModules">>;
   /** Resolve vertical- or runtime-local actions without mutating the process-wide registry. */
@@ -1532,9 +1781,29 @@ export interface PlatformHostOptions<TDb> {
    * approval resume, exhausted attempts, and marker-write failures are not retried.
    * Policy persistence, obligation listing/resolution/persistence, state-machine checks,
    * the handler transaction, handlers, adapters, and finalization are excluded;
-   * their failure/reconciliation/recovery semantics apply, subject to recoveryMaxAttempts.
+   * their separate failure/reconciliation/recovery semantics apply, including handlerRetry
+   * for confirmed handler rollback, subject to recoveryMaxAttempts.
    */
   retryableExecutionMaxAttempts?: number;
+  /** Bounded retries within one execution attempt after confirmed handler rollback. */
+  handlerRetry?: {
+    /** Total transaction tries, including the first; integer 1–10, default 3. One disables retry. */
+    maxAttempts?: number;
+    /** Assert the whole retried unit kept effects in the transaction. Literal true opts in; throws refuse retry. */
+    classify?: (error: unknown, context: {
+      actionId: string;
+    }) => boolean;
+    /** Retry number starts at 1. Default full jitter on 25 ms doubling; clamped to 0–1000 ms. Throws/non-finite stop retry. */
+    delayMs?: number | ((retry: number) => number);
+    /** Called before each delay; attempt is the upcoming try (2..maxAttempts). Sync throws and async rejections are ignored without awaiting. */
+    onRetry?: (info: {
+      actionInvocationId: string;
+      actionId: string;
+      attempt: number;
+      maxAttempts: number;
+      error: unknown;
+    }) => void;
+  };
   /**
    * Positive integer cap on worker claims for resumed leased running invocations
    * including the first (default max(5, retryableExecutionMaxAttempts); Infinity is rejected).
@@ -1550,6 +1819,8 @@ export interface PlatformHostOptions<TDb> {
   services?: FabricRuntimeServices;
   idempotency?: {
     conflictMode?: "audit-only" | "enforce";
+    /** Reserve keyed definitive submission refusals. Requires enforcing identity and store support. */
+    recordRefusals?: boolean;
     onConflict?(conflict: IdempotencyConflict): void;
     onLegacyRecord?(invocation: ActionInvocationRecord): void;
   };
@@ -1581,6 +1852,8 @@ export interface PlatformHostOptions<TDb> {
   approvalDefaultTtlMs?: number;
   /** Atomic approval lifecycle events and outbox writes; defaults to false. */
   approvalLifecycleEvents?: boolean;
+  /** Atomic audit events for refused recording attempts; defaults to false. */
+  approvalDecisionAttemptEvents?: boolean;
   /** Durable evaluator/ruleset version recorded with every HITL decision. */
   hitlPolicyVersion?: string;
   /** Optional portable resolver; provider-specific implementations belong in integration packages. */
@@ -1696,6 +1969,10 @@ export interface PlatformHostOptions<TDb> {
    */
   adapterDeadlineMs?: number;
 }
+/** Additive capability; handwritten GovernedActionHost implementations retain their existing shape. */
+export interface ApprovalDecisionRecordingHost {
+  recordApprovalDecision(id: string, tenantId: string, spaceId: string, request: RecordApprovalDecisionRequest): Promise<RecordApprovalDecisionResult>;
+}
 export interface ApprovalExpiryHost {
   expireDueApprovals(input?: ExpireDueApprovalsInput): Promise<{
     expired: string[];
@@ -1747,20 +2024,59 @@ export interface OutboxRequeueHost {
    */
   requeueOutboxDeadLetter(input: RequeueOutboxDeadLetterInput): Promise<RequeueOutboxDeadLetterResult>;
 }
+/** Exact durable key scope; an empty idempotency key is valid. */
+export interface SubmissionOutcomeKey {
+  tenantId: string;
+  spaceId: string;
+  actionId: ActionId;
+  idempotencyKey: string;
+}
+export type StoredSubmissionOutcomeRecord = Readonly<SubmissionOutcomeKey & Pick<ActionInvocationRecord, "id" | "actionVersion" | "actorId" | "actorType" | "authorizationBindingId" | "idempotencyActorId" | "idempotencyAuthorizationBindingId" | "status" | "submissionRefusal" | "storedRecordsErased">>;
+export interface ReadSubmissionOutcomeInput extends SubmissionOutcomeKey {
+  actorId: string;
+  actorType: ActorType;
+  authorizationBindingId?: string;
+}
+type ReceiptIdentity = {
+  actionInvocationId: string;
+  actionVersion: number;
+};
+export type ReadSubmissionOutcomeResult = {
+  kind: "no_record";
+} | (ReceiptIdentity & {
+  kind: "submission_refused";
+  submissionRefusal: SubmissionRefusalDescriptor;
+}) | (ReceiptIdentity & {
+  kind: "invocation";
+  status: Exclude<ActionStatus, "submission_refused">;
+}) | (ReceiptIdentity & {
+  kind: "records_erased";
+  recordedStatus: ActionStatus;
+});
+export interface SubmissionOutcomeReader {
+  readSubmissionOutcome(input: Readonly<ReadSubmissionOutcomeInput>): Promise<ReadSubmissionOutcomeResult>;
+}
 //#endregion
 //#region src/host.d.ts
-export declare function createGovernedActionHost<TDb>(options: PlatformHostOptions<TDb>): GovernedActionHost & OutboxRequeueHost & ApprovalExpiryHost;
+export declare function createGovernedActionHost<TDb>(options: PlatformHostOptions<TDb>): SubmissionOutcomeReader & GovernedActionHost & OutboxRequeueHost & ApprovalExpiryHost & ApprovalDecisionRecordingHost & StoredRecordErasureHost;
 //#endregion
 //#region src/memory-store.d.ts
+/**
+ * Optional domain snapshot/restore binder. The Host handler callback can request
+ * rollback confirmation after a failed callback and successful undo/restore.
+ * Commit failures and providerless internal transactions supply no confirmation.
+ * Ordinary public transaction callbacks retain their original error objects.
+ */
 export interface MemoryPlatformHostTransactionProvider<TDb> {
   snapshot(db: TDb): TDb;
   restore(db: TDb, snapshot: TDb): void;
 }
-export declare class MemoryPlatformHostStore<TDb> implements RecoverablePlatformHostStore<TDb>, ApprovalPlatformHostStore<TDb>, GovernancePlatformHostStore<TDb>, OutboxPlatformHostStore<TDb>, OutboxRequeuePlatformHostStore<TDb>, StagedInvocationPlatformHostStore<TDb> {
+export declare class MemoryPlatformHostStore<TDb> implements ErasablePlatformHostStore<TDb>, RecoverablePlatformHostStore<TDb>, ApprovalPlatformHostStore<TDb>, GovernancePlatformHostStore<TDb>, OutboxPlatformHostStore<TDb>, OutboxRequeuePlatformHostStore<TDb>, StagedInvocationPlatformHostStore<TDb> {
   readonly db: TDb;
+  getSubmissionOutcomeByKey(key: Readonly<SubmissionOutcomeKey>): Promise<StoredSubmissionOutcomeRecord | undefined>;
   readonly transactionalOutbox: boolean;
   readonly transactionalApprovalLifecycle: boolean;
-  private readonly approvalTransactionProvider;
+  readonly transactionalApprovalAuthorization = true;
   readonly transactionalStagedInvocations: boolean;
   transactionWithEvents?: <TResult>(run: (transaction: PlatformHostMutationTransaction<TDb>) => Promise<TResult>) => Promise<TResult>;
   private adapterCommit;
@@ -1781,10 +2097,16 @@ export declare class MemoryPlatformHostStore<TDb> implements RecoverablePlatform
    * `private`, as for the store's other internals, is a compile-time guard.
    */
   private readonly outboxRequeues;
+  private readonly erasedStages;
+  private readonly erasureMarkers;
+  private isErased;
+  private assertNotErased;
+  eraseStoredRecords(request: EraseStoredRecordsInput): Promise<EraseStoredRecordsResult>;
   constructor(db: TDb, transactionProvider?: MemoryPlatformHostTransactionProvider<TDb>);
   transaction<TResult>(run: (db: TDb) => Promise<TResult>): Promise<TResult>;
   private runTransactionWithEvents;
   createActionInvocation(input: CreateActionInvocationInput): Promise<ActionInvocationRecord>;
+  recordSubmissionRefusal(input: RecordSubmissionRefusalInput): Promise<ActionInvocationRecord>;
   createActionInvocationForStagedLease(input: CreateStagedActionInvocationInput): Promise<CreateStagedActionInvocationResult>;
   private applyStagedBatch;
   getActionInvocation(id: string, tenantId: string, spaceId: string): Promise<ActionInvocationRecord | undefined>;
@@ -1793,7 +2115,8 @@ export declare class MemoryPlatformHostStore<TDb> implements RecoverablePlatform
   recordHitlDecision(actionInvocationId: string, tenantId: string, spaceId: string, decision: HitlDecisionEvidence): Promise<ActionInvocationRecord>;
   private runApprovalTransaction;
   parkApproval(input: ParkApprovalInput): Promise<ApprovalDecisionTransitionResult>;
-  beginApprovalDecision(input: BeginApprovalDecisionInput): Promise<ApprovalDecisionTransitionResult>;
+  recordApprovalDecision(input: RecordApprovalDecisionStoreInput<TDb>): Promise<RecordApprovalDecisionStoreResult>;
+  beginApprovalDecision(input: BeginApprovalDecisionInput<TDb>): Promise<ApprovalDecisionTransitionResult>;
   expireDueApprovals(input: ExpireDueApprovalsStoreInput): Promise<ActionInvocationRecord[]>;
   appendPolicyEvaluation(record: PolicyEvaluationRecord): Promise<void>;
   recordMutationGovernance(actionInvocationId: string, tenantId: string, spaceId: string, context: Pick<ActionInvocationRecord, "mutationFootprint" | "executionPrincipal"> & {
@@ -1824,13 +2147,14 @@ export declare class MemoryPlatformHostStore<TDb> implements RecoverablePlatform
     availableAt: Date;
     deadLetter: boolean;
   }): Promise<void>;
-  renewOutboxLease(input: {
+  renewOutboxLease(input: Parameters<OutboxPlatformHostStore<TDb>["renewOutboxLease"]>[0]): Promise<boolean>;
+  renewOutboxLeaseAndRead(input: {
     id: string;
     workerId: string;
     leaseToken: number;
     leaseDurationMs: number;
     now?: Date;
-  }): Promise<boolean>;
+  }): Promise<OutboxRecord | undefined>;
   listOutbox(input?: {
     tenantId?: string;
     spaceId?: string;
@@ -1972,21 +2296,38 @@ export interface PostgresPlatformHostTransactionContext<TDb> {
  * `pg.PoolClient`. Production applications provide this adapter so domain
  * methods and Host ledger writes share one PostgreSQL transaction.
  */
+/**
+ * May reject with ConfirmedTransactionRollback(callbackError) after successful rollback
+ * of a failed callback. Providers omitting that evidence get no in-attempt handler retry.
+ * Commit errors must not be represented as confirmed callback rollback. The store exposes
+ * evidence at the Host handler callback request and normalizes it for other consumers.
+ */
 export interface PostgresPlatformHostTransactionProvider<TDb> {
   run<TResult>(run: (context: PostgresPlatformHostTransactionContext<TDb>) => Promise<TResult>): Promise<TResult>;
 }
 /** Durable mutation-pipeline ledger for Databricks Lakebase or standard Postgres. */
-export declare class PostgresPlatformHostStore<TDb> implements RecoverablePlatformHostStore<TDb>, ApprovalPlatformHostStore<TDb>, GovernancePlatformHostStore<TDb>, OutboxPlatformHostStore<TDb>, OutboxRequeuePlatformHostStore<TDb>, StagedInvocationPlatformHostStore<TDb> {
+export declare class PostgresPlatformHostStore<TDb> implements ErasablePlatformHostStore<TDb>, RecoverablePlatformHostStore<TDb>, ApprovalPlatformHostStore<TDb>, GovernancePlatformHostStore<TDb>, OutboxPlatformHostStore<TDb>, OutboxRequeuePlatformHostStore<TDb>, StagedInvocationPlatformHostStore<TDb> {
   readonly db: TDb;
   private readonly sql;
+  private readonly transactionProvider?;
   readonly transactionWithEvents?: AtomicMutationPlatformHostStore<TDb>["transactionWithEvents"];
+  private ownerLocksPersist;
+  private readonly lockedOwners;
   readonly transactionalOutbox: boolean;
   readonly transactionalApprovalLifecycle: boolean;
+  readonly transactionalApprovalAuthorization: boolean;
   readonly transactionalStagedInvocations: boolean;
-  constructor(db: TDb, sql: PlatformHostSqlClient, transactionProvider?: PostgresPlatformHostTransactionProvider<TDb>);
+  constructor(db: TDb, sql: PlatformHostSqlClient, transactionProvider?: PostgresPlatformHostTransactionProvider<TDb> | undefined);
+  /** Internal provider entry: non-handler consumers retain their original error objects. */
+  private runTransaction;
+  private refuseErased;
+  private ownerFence;
   ensureSchema(): Promise<void>;
+  eraseStoredRecords(request: EraseStoredRecordsInput): Promise<EraseStoredRecordsResult>;
   transaction<TResult>(run: (db: TDb) => Promise<TResult>): Promise<TResult>;
+  getSubmissionOutcomeByKey(key: Readonly<SubmissionOutcomeKey>): Promise<StoredSubmissionOutcomeRecord | undefined>;
   createActionInvocation(input: CreateActionInvocationInput): Promise<ActionInvocationRecord>;
+  recordSubmissionRefusal(input: RecordSubmissionRefusalInput): Promise<ActionInvocationRecord>;
   createActionInvocationForStagedLease(input: CreateStagedActionInvocationInput): Promise<CreateStagedActionInvocationResult>;
   stageInvocations(records: readonly StagedInvocationRecord[]): Promise<void>;
   getActionInvocation(id: string, tenantId: string, spaceId: string): Promise<ActionInvocationRecord | undefined>;
@@ -1995,7 +2336,9 @@ export declare class PostgresPlatformHostStore<TDb> implements RecoverablePlatfo
   recordHitlDecision(actionInvocationId: string, tenantId: string, spaceId: string, decision: HitlDecisionEvidence): Promise<ActionInvocationRecord>;
   parkApproval(input: ParkApprovalInput): Promise<ApprovalDecisionTransitionResult>;
   expireDueApprovals(input: ExpireDueApprovalsStoreInput): Promise<ActionInvocationRecord[]>;
-  beginApprovalDecision(input: BeginApprovalDecisionInput): Promise<ApprovalDecisionTransitionResult>;
+  private lockDueApprovals;
+  recordApprovalDecision(input: RecordApprovalDecisionStoreInput<TDb>): Promise<RecordApprovalDecisionStoreResult>;
+  beginApprovalDecision(input: BeginApprovalDecisionInput<TDb>): Promise<ApprovalDecisionTransitionResult>;
   appendPolicyEvaluation(record: PolicyEvaluationRecord): Promise<void>;
   recordMutationGovernance(actionInvocationId: string, tenantId: string, spaceId: string, context: {
     footprint: NonNullable<ActionInvocationRecord["mutationFootprint"]>;
@@ -2024,13 +2367,14 @@ export declare class PostgresPlatformHostStore<TDb> implements RecoverablePlatfo
     availableAt: Date;
     deadLetter: boolean;
   }): Promise<void>;
-  renewOutboxLease(input: {
+  renewOutboxLease(input: Parameters<OutboxPlatformHostStore<TDb>["renewOutboxLease"]>[0]): Promise<boolean>;
+  renewOutboxLeaseAndRead(input: {
     id: string;
     workerId: string;
     leaseToken: number;
     leaseDurationMs: number;
     now?: Date;
-  }): Promise<boolean>;
+  }): Promise<OutboxRecord | undefined>;
   listOutbox(input?: {
     tenantId?: string;
     spaceId?: string;
@@ -2115,7 +2459,9 @@ export declare class PostgresPlatformHostStore<TDb> implements RecoverablePlatfo
   updateLeasedActionInvocation(input: UpdateLeasedActionInvocationInput): Promise<boolean>;
   renewActionInvocationLease(input: RenewActionInvocationLeaseInput): Promise<boolean>;
   listEvents(tenantId: string, spaceId: string): Promise<AssetEventEnvelope[]>;
-  getEvent(id: string, tenantId: string, spaceId: string): Promise<AssetEventEnvelope | undefined>;
+  getEvent(id: string, tenantId: string, spaceId: string): Promise<(AssetEventEnvelope & {
+    readonly storedRecordsErased?: true;
+  }) | undefined>;
 }
 //#endregion
 //#region src/postgres-migrations.d.ts
@@ -2259,6 +2605,11 @@ export declare function prepareStagedInvocationBatch<TDb>(input: PrepareStagedIn
 export declare function stagedInvocationRequestIdentity(record: StagedInvocationRecord): string;
 export declare function cloneStagedInvocationRecord(record: StagedInvocationRecord): StagedInvocationRecord;
 export declare function asStagedInvocationStore<TDb>(store: PlatformHostStore<TDb>): StagedInvocationPlatformHostStore<TDb> | undefined;
+/** Placeholder for published payload-covering batch digests replaced by migration 16. */
+export declare const LEGACY_BATCH_DIGEST = "legacy-batch";
+/** Replay comparison used by both built-in stores. Compares the full request identity,
+ * skipping only the batch-digest comparison when the stored row carries LEGACY_BATCH_DIGEST. */
+export declare function stagedInvocationRequestMatches(stored: StagedInvocationRecord, incoming: StagedInvocationRecord): boolean;
 //#endregion
 //#region src/tenant-isolation.d.ts
 export interface TenantIsolationScope {
@@ -2291,13 +2642,13 @@ export interface TenantIsolationSubject<TDb = unknown> {
   }>;
   /**
    * Optional: put the host and store back to a known state before a check.
-   * The checks tolerate accumulated state, and each retires any row it
-   * creates directly, so this exists for subjects whose store is shared.
+   * The checks tolerate accumulated state, and direct probes use terminal rows
+   * or retire the active rows they create, so this exists for subjects whose store is shared.
    */
   reset?(): Promise<void> | void;
 }
 export interface TenantIsolationCheck {
-  id: "fabric.tenancy.invocation-scoped-read.v1" | "fabric.tenancy.idempotency-key-scoped.v1" | "fabric.tenancy.events-scoped.v1" | "fabric.tenancy.worker-claim-scoped.v1" | "fabric.tenancy.staged-invocation-scoped.v1" | "fabric.tenancy.completion-scoped.v1" | "fabric.tenancy.projection-scoped.v1" | "fabric.tenancy.adapter-invocation-read-scoped.v1" | "fabric.tenancy.adapter-invocation-write-scoped.v1";
+  id: "fabric.tenancy.invocation-scoped-read.v1" | "fabric.tenancy.idempotency-key-scoped.v1" | "fabric.tenancy.submission-refusal-scoped.v1" | "fabric.tenancy.events-scoped.v1" | "fabric.tenancy.worker-claim-scoped.v1" | "fabric.tenancy.staged-invocation-scoped.v1" | "fabric.tenancy.completion-scoped.v1" | "fabric.tenancy.projection-scoped.v1" | "fabric.tenancy.adapter-invocation-read-scoped.v1" | "fabric.tenancy.adapter-invocation-write-scoped.v1";
   run(subject: TenantIsolationSubject): Promise<string[]>;
 }
 export interface TenantIsolationResult {
@@ -2312,9 +2663,10 @@ export interface TenantIsolationResult {
 /**
  * The suite a deployment of the host must pass before it claims isolation.
  *
- * Nine checks: an invocation cannot be read, executed, or completed under
+ * Ten checks: an invocation cannot be read, executed, or completed under
  * another tenant's scope; an idempotency key is a tenant's own, so the same
- * key in two tenants is two invocations; a tenant's event stream carries no
+ * key in two tenants is two invocations; optional recorded refusals retain
+ * tenant and space scope, including when ordinary creation encounters a refusal; a tenant's event stream carries no
  * other tenant's events; a worker scoped to one tenant does not claim another's
  * work; staged listing and claiming retain tenant and space scope; an adapter
  * checkpoint cannot be read or written under another tenant, space, or owning
@@ -2401,4 +2753,224 @@ export declare function eventAppendChecks(): readonly EventAppendCheck[];
  */
 export declare function runEventAppendChecks<TDb>(subject: EventAppendSubject<TDb>): Promise<EventAppendResult>;
 //#endregion
-export { canonicalJson };
+//#region src/erasure.d.ts
+export declare function createStoredRecordErasureHost<TDb>(store: PlatformHostStore<TDb>, authorization: Pick<PlatformHostAuthorization<TDb>, "authorizeStoredRecordErasure">): StoredRecordErasureHost;
+//#endregion
+//#region src/erasure-conformance.d.ts
+export interface ErasureProbeScope {
+  tenantId: string;
+  spaceId: string;
+  invocationId: string;
+}
+export interface ErasureSubject<TDb = unknown> {
+  store: PlatformHostStore<TDb> & Partial<ErasablePlatformHostStore<TDb>> & {
+    listEvents?(tenantId: string, spaceId: string): Promise<AssetEventEnvelope[]>;
+  };
+  tenantId: string;
+  /** Test-store fixture access for record kinds not readable through the base store port. */
+  payloadRecords?: {
+    seed(scope: ErasureProbeScope, sentinel: string): Promise<void>;
+    read(scope: ErasureProbeScope): Promise<readonly {
+      kind: ErasureRecordKind;
+      value: unknown;
+    }[]>;
+  };
+}
+export interface ErasureCheck {
+  id: string;
+  run(subject: ErasureSubject): Promise<string[]>;
+}
+export interface ErasureResult {
+  passed: boolean;
+  checks: Array<{
+    id: string;
+    status: "passed" | "failed" | "skipped";
+    evidence: string[];
+    error?: string;
+  }>;
+}
+/** Destructive probes for isolated test stores; leave evidence in fresh probe spaces. */
+export declare function erasureChecks(): readonly ErasureCheck[];
+export declare function runErasureChecks<TDb>(subject: ErasureSubject<TDb>): Promise<ErasureResult>;
+//#endregion
+//#region src/erasure-errors.d.ts
+/** Host authorization refusal; contains no target existence or authorizer failure details. */
+export declare class StoredRecordErasureAuthorizationError extends Error {
+  readonly refusal = "not_authorized";
+  constructor(message: string);
+}
+/** A later mutation of an erased record was refused. */
+export declare class StoredRecordsErasedError extends Error {
+  readonly code = "HOST_RECORDS_ERASED";
+  constructor();
+}
+/** Erasure could not lock its targets or finish within the configured budget. */
+export declare class ErasureBusyError extends Error {
+  readonly reason: "lock_timeout" | "work_timeout";
+  readonly code = "HOST_ERASURE_BUSY";
+  constructor(reason: "lock_timeout" | "work_timeout", options?: ErrorOptions);
+}
+//#endregion
+//#region src/staged-invocation-conformance.d.ts
+export type StagedContractStore = StagedInvocationPlatformHostStore<unknown> & AtomicMutationPlatformHostStore<unknown>;
+export interface StagedCreateRotateRaceInput {
+  record: StagedInvocationRecord;
+  workerId: string;
+  leaseToken: number;
+  now: Date;
+  invocation: CreateActionInvocationInput & {
+    stagedOrigin: {
+      parentInvocationId: string;
+      stageKey: string;
+      principal?: string;
+    };
+  };
+}
+export interface StagedCreateRotateRaceOutcome {
+  creation: CreateStagedActionInvocationResult;
+  rotatedToken: number | undefined;
+}
+/**
+ * A store whose fence can interleave with rotation (PostgreSQL) supplies the
+ * two races with the first operation held open in a transaction, proving the
+ * second waits for it. Without them the contract runs both operations
+ * concurrently, which serializes in the memory store.
+ */
+export interface StagedContractHarness {
+  store: StagedContractStore;
+  /** Fenced create held uncommitted; a rotation under the same token must wait for it. */
+  raceCreateThenRotate?(input: StagedCreateRotateRaceInput): Promise<StagedCreateRotateRaceOutcome>;
+  /** Rotation held uncommitted; a fenced create under the old token must wait, then create nothing. */
+  raceRotateThenCreate?(input: StagedCreateRotateRaceInput): Promise<StagedCreateRotateRaceOutcome>;
+}
+export interface StagedInvocationSubject {
+  makeHarness(): Promise<StagedContractHarness>;
+}
+export interface StagedInvocationCheck {
+  id: string;
+  run(subject: StagedInvocationSubject): Promise<string[]>;
+}
+export interface StagedInvocationResult {
+  passed: boolean;
+  checks: Array<{
+    id: string;
+    status: "passed" | "failed" | "skipped";
+    evidence: string[];
+    error?: string;
+  }>;
+}
+/** Destructive probes for isolated test stores; leave records in fresh probe spaces. */
+export declare function stagedInvocationChecks(): readonly StagedInvocationCheck[];
+export declare function runStagedInvocationChecks(subject: StagedInvocationSubject): Promise<StagedInvocationResult>;
+//#endregion
+//#region src/outbox-requeue-conformance.d.ts
+export interface OutboxRequeueSubject {
+  makeStore(): Promise<OutboxRequeuePlatformHostStore<unknown>>;
+}
+export interface OutboxRequeueCheck {
+  id: string;
+  run(subject: OutboxRequeueSubject): Promise<string[]>;
+}
+export interface OutboxRequeueResult {
+  passed: boolean;
+  checks: Array<{
+    id: string;
+    status: "passed" | "failed" | "skipped";
+    evidence: string[];
+    error?: string;
+  }>;
+}
+/** Destructive probes for isolated test stores; leave outbox and audit records under fresh identities. */
+export declare function outboxRequeueChecks(): readonly OutboxRequeueCheck[];
+export declare function runOutboxRequeueChecks(subject: OutboxRequeueSubject): Promise<OutboxRequeueResult>;
+//#endregion
+//#region src/approval-conformance.d.ts
+export type ApprovalCheckStore = ApprovalPlatformHostStore<{}> & Partial<AtomicMutationPlatformHostStore<{}>> & RecoverablePlatformHostStore<{}> & OutboxPlatformHostStore<{}>;
+export interface ApprovalSubject {
+  makeStore(): Promise<ApprovalCheckStore>;
+}
+export interface ApprovalCheck {
+  id: string;
+  run(subject: ApprovalSubject): Promise<string[]>;
+}
+export interface ApprovalResult {
+  passed: boolean;
+  checks: Array<{
+    id: string;
+    status: "passed" | "failed" | "skipped";
+    evidence: string[];
+    error?: string;
+  }>;
+}
+/** Destructive probes for isolated test stores; leave invocation, event and outbox evidence under fresh identities. */
+export declare function approvalChecks(): readonly ApprovalCheck[];
+export declare function runApprovalChecks(subject: ApprovalSubject): Promise<ApprovalResult>;
+//#endregion
+//#region src/outbox-relay-conformance.d.ts
+export interface OutboxRelaySubject {
+  makeStore(): Promise<OutboxPlatformHostStore<unknown>>;
+}
+export interface OutboxRelayCheck {
+  id: string;
+  run(subject: OutboxRelaySubject): Promise<string[]>;
+}
+export interface OutboxRelayConformanceResult {
+  passed: boolean;
+  checks: Array<{
+    id: string;
+    status: "passed" | "failed" | "skipped";
+    evidence: string[];
+    error?: string;
+  }>;
+}
+/** Destructive probes for isolated test stores; leave outbox records under fresh identities and spaces. */
+export declare function outboxRelayChecks(): readonly OutboxRelayCheck[];
+export declare function runOutboxRelayChecks(subject: OutboxRelaySubject): Promise<OutboxRelayConformanceResult>;
+//#endregion
+//#region src/invocation-idempotency-conformance.d.ts
+export interface InvocationIdempotencySubject {
+  makeStore(): Promise<PlatformHostStore<unknown>>;
+}
+export interface InvocationIdempotencyCheck {
+  id: string;
+  run(subject: InvocationIdempotencySubject): Promise<string[]>;
+}
+export interface InvocationIdempotencyResult {
+  passed: boolean;
+  checks: Array<{
+    id: string;
+    status: "passed" | "failed" | "skipped";
+    evidence: string[];
+    error?: string;
+  }>;
+}
+/** Destructive probes for isolated test stores; leave invocation records under fresh identities and spaces. */
+export declare function invocationIdempotencyChecks(): readonly InvocationIdempotencyCheck[];
+export declare function runInvocationIdempotencyChecks(subject: InvocationIdempotencySubject): Promise<InvocationIdempotencyResult>;
+//#endregion
+//#region src/transaction-rollback.d.ts
+/** Evidence from a transaction provider that rollback completed successfully. */
+export declare class ConfirmedTransactionRollback extends Error {
+  readonly name = "ConfirmedTransactionRollback";
+  readonly code: "TRANSACTION_ROLLBACK_CONFIRMED";
+  constructor(cause: unknown);
+}
+/** Recognise rollback evidence across ESM/CommonJS or other package copies. */
+export declare function isConfirmedTransactionRollback(error: unknown): error is ConfirmedTransactionRollback;
+/** Inspect up to 16 errors, failing closed on cycles or unreadable properties. Intended for handlerRetry.classify. */
+export declare function isTransientPostgresTransactionError(error: unknown): boolean;
+//#endregion
+//#region src/submission-outcome.d.ts
+export declare class SubmissionOutcomeUnsupportedError extends Error {
+  constructor();
+}
+//#endregion
+//#region src/submission-outcome-conformance.d.ts
+/**
+ * Isolated destructive probe with fresh identities and timestamps from new Date().
+ * Refusal and erasure sections run only with their respective store capabilities;
+ * returned evidence identifies each unexercised optional section with `skipped:`.
+ */
+export declare function checkSubmissionOutcomeStore(store: PlatformHostStore<unknown>): Promise<string[]>;
+//#endregion
+export { type ErasablePlatformHostStore, type EraseStoredRecordsInput, type EraseStoredRecordsResult, type ErasurePayloadFields, type ErasureRecordKind, type StoredRecordErasureAuthorizationInput, type StoredRecordErasureHost, type StoredRecordErasureOutcome, type StoredRecordErasureTarget, type StoredRecordErasureView, canonicalJson };